CVE-2026-1529

Summary

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat build of Keycloak 26.226.2.13-1 < *unaffected
Red HatRed Hat build of Keycloak 26.226.2-15 < *unaffected
Red HatRed Hat build of Keycloak 26.226.2-15 < *unaffected
Red HatRed Hat build of Keycloak 26.426.4.9-1 < *unaffected
Red HatRed Hat build of Keycloak 26.426.4-11 < *unaffected
Red HatRed Hat build of Keycloak 26.426.4-10 < *unaffected

Weaknesses

  • CWE-347: Improper Verification of Cryptographic Signature

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

org.keycloak.services.resources.organizations: Keycloak: Unauthorized organization registration via improper invitation token validation

Additional References

References